MGASA-2021-0400 - Updated webkit2 packages fix security vulnerabilities

Publication date: 14 Aug 2021
URL: https://advisories.mageia.org/MGASA-2021-0400.html
Type: security
Affected Mageia releases: 8
CVE: CVE-2021-21775,
     CVE-2021-21779,
     CVE-2021-30663,
     CVE-2021-30665,
     CVE-2021-30689,
     CVE-2021-30720,
     CVE-2021-30734,
     CVE-2021-30744,
     CVE-2021-30749,
     CVE-2021-30758,
     CVE-2021-30795,
     CVE-2021-30797,
     CVE-2021-30799

Updated webkit2 packages fix security vulnerabilities:

A use-after-free vulnerability exists in the way certain events are
processed for ImageLoader objects of Webkit WebKitGTK 2.30.4. A specially
crafted web page can lead to a potential information leak and further
memory corruption. In order to trigger the vulnerability, a victim must
be tricked into visiting a malicious webpage (CVE-2021-21775).

A use-after-free vulnerability exists in the way Webkit GraphicsContext
handles certain events in WebKitGTK 2.30.4. A specially crafted web page
can lead to a potential information leak and further memory corruption.
A victim must be tricked into visiting a malicious web page to trigger
this vulnerability (CVE-2021-21779).

Processing maliciously crafted web content may lead to arbitrary code
execution (CVE-2021-30663, CVE-2021-30665, CVE-2021-30734, CVE-2021-30749,
CVE-2021-30758, CVE-2021-30795, CVE-2021-30797, CVE-2021-30799).

Processing maliciously crafted web content may lead to universal cross
site scripting (CVE-2021-30689, CVE-2021-30744).

A malicious website may be able to access restricted ports on arbitrary
servers (CVE-2021-30720).

References:
- https://bugs.mageia.org/show_bug.cgi?id=29282
- https://webkitgtk.org/2021/07/09/webkitgtk2.32.2-released.html
- https://webkitgtk.org/2021/07/23/webkitgtk2.32.3-released.html
- https://webkitgtk.org/security/WSA-2021-0004.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21775
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21779
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30663
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30665
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30689
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30720
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30734
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30744
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30749
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30758
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30795
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30797
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30799

SRPMS:
- 8/core/webkit2-2.32.3-1.mga8